Iowa Admin. Code r. 191-90.2

Current through Register Vol. 46, No. 21, April 17, 2024

Rule 191-90.2 - Definitions

For the purpose of these rules, the following definitions shall apply:

"Affiliate" means any company that controls, is controlled by or is under common control with another company.

"Clear and conspicuous" means that a notice is reasonably understandable and designed to call attention to the nature and significance of the information in the notice.

"Collect" means to obtain information that the licensee organizes or can retrieve by the name of an individual or by identifying number, symbol or other identifying article assigned to the individual, irrespective of the source of the underlying information.

"Commissioner" means the insurance commissioner.

"Company" means a corporation, limited liability company, business trust, general or limited partnership, association, sole proprietorship or similar organization.

"Consumer" means an individual, or that individual's legal representative, who seeks to obtain, obtains or has obtained from a licensee an insurance product or service that is to be used primarily for personal, family or household purposes and about whom the licensee has nonpublic personal information. "Consumer" includes any of the following:

1. An individual who provides nonpublic personal information to a licensee in connection with obtaining or seeking to obtain financial, investment or economic advisory services relating to an insurance product or service is a consumer regardless of whether the licensee establishes an ongoing advisory relationship.

2. An applicant for insurance prior to the inception of insurance coverage is a licensee's consumer.

3. An individual is a licensee's consumer if:

* The individual is a beneficiary of a life insurance policy underwritten by the licensee;

* The individual is a claimant under an insurance policy issued by the licensee;

* The individual is an insured or an annuitant under an insurance policy or an annuity, respectively, issued by the licensee; or

* The individual is a mortgagor of a mortgage covered under a mortgage insurance policy; and

* The licensee discloses nonpublic personal financial information about the individual to a nonaffiliated third party other than as permitted under rules 191-90.12 (505), 191-90.13 (505) and 191-90.14 (505) of this chapter.

An individual who is a consumer of another financial institution is not a licensee's consumer solely because the licensee is acting as agent for, or provides processing or other services to, that financial institution.

An individual is not the consumer of the licensee provided that the licensee provides the initial, annual and revised notices required under rules 191-90.3 (505), 191-90.4 (505), and 191-90.7 (505) to the plan sponsor, group or blanket insurance policyholder or group annuity contract holder, workers' compensation plan participant, or further, provided that the licensee does not disclose to a nonaffiliated third party nonpublic personal financial information about such an individual other than as permitted under rules 191-90.12 (505), 191-90.13 (505), and 191-90.14 (505) and solely due to any of the following:

a. The consumer is a participant in or a beneficiary of an employee benefit plan that the licensee administers or sponsors or for which the licensee acts as a trustee, insurer or fiduciary,

b. The consumer is covered under a group or blanket insurance policy or group annuity contract issued by the licensee, or

c. The consumer is a beneficiary in a workers' compensation plan.

However, an individual described in "a" through "c" is a consumer of a licensee if the licensee does not meet all the above conditions. In no event shall an individual solely by virtue of the status described in "a" through "c" above be deemed a customer for purposes of this chapter.

An individual is not a licensee's consumer solely because the individual is a beneficiary of a trust for which the licensee is a trustee or because the individual has designated the licensee as trustee for a trust.

"Consumer reporting agency" means "consumer reporting agency" as defined in Section 603(f) of the federal Fair Credit Reporting Act.

"Control" means any of the following:

1. Ownership, control or power to vote 25 percent or more of the outstanding shares of any class of voting security of the company, directly or indirectly, or acting through one or more other persons;

2. Control in any manner over the election of a majority of the directors, trustees or general partners or individuals exercising similar functions of the company; or

3. The power to exercise, directly or indirectly, a controlling influence over the management or policies of the company, as the commissioner determines.

"Customer" means a consumer who has a customer relationship with a licensee.

"Customer information" means nonpublic personal information about a customer, whether the information is in paper, electronic or other form, that is maintained by or on behalf of the licensee.

"Customer information systems" means the electronic or physical methods used to access, collect, store, use, transmit, protect or dispose of customer information.

"Customer relationship" means a continuing relationship between a consumer and a licensee under which the licensee provides to the consumer one or more insurance products or services that are to be used primarily for personal, family or household purposes.

A consumer has a continuing relationship with a licensee if the consumer is a current policyholder of an insurance product issued by or through the licensee or if the consumer obtains financial, investment or economic advisory services relating to an insurance product or service from the licensee for a fee.

A consumer does not have a continuing relationship with a licensee under the following examples:

1. The consumer applies for insurance but does not purchase the insurance;

2. The licensee sells the consumer airline travel insurance in an isolated transaction;

3. The individual is no longer a current policyholder of an insurance product or no longer obtains insurance services with or through the licensee;

4. The consumer is a beneficiary or claimant under a policy and has submitted a claim under a policy choosing a settlement option involving an ongoing relationship with the licensee;

5. The consumer is a beneficiary or a claimant under a policy and has submitted a claim under that policy choosing a lump sum settlement option;

6. The customer's policy is lapsed, expired, or otherwise inactive or dormant under the licensee's business practices and the licensee has not communicated with the customer about the relationship for a period of 12 consecutive months, other than annual privacy notices, material required by law or regulation, communication at the direction of a state or federal authority, or promotional materials;

7. The individual is an insured or an annuitant under an insurance policy or annuity, respectively, but is not the policyholder or owner of the insurance policy or annuity; or

8. For the purposes of these rules, the individual's last-known address according to the licensee's record is deemed invalid. An address of record is deemed invalid if mail sent to that address by the licensee has been returned by the postal authorities as undeliverable and if subsequent attempts by the licensee to obtain a current valid address for the individual have been unsuccessful.

"Designed to call attention" means a licensee designs its notice to call attention to the nature and significance of the information in a notice if the licensee does the following:

1. Uses a plain-language heading to call attention to the notice;

2. Uses a typeface and type size that are easy to read;

3. Provides wide margins and ample line spacing;

4. Uses boldface or italics for key words; and

5. Uses a form that combines the licensee's notice with other information and uses distinctive type size, style, and graphic devices, such as shading or sidebars.

"Financial institution" means any institution the business of which is engaging in activities that are financial in nature or incidental to the financial activities described in Section 4(k) of the Bank Holding Company Act of 1956. "Financial institution" does not include the following:

1. Any person or entity with respect to any financial activity that is subject to the jurisdiction of the commodity futures trading commissioner under the Commodity Exchange Act.

2. The Federal Agricultural Mortgage Corporation or any entity charged and operating under the Farm Credit Act of 1971.

3. Institutions chartered by Congress specifically to engage in securitizations, secondary market sales including sales of servicing rights, or similar transactions related to a transaction of a consumer as long as the institutions do not sell or transfer nonpublic personal information to a nonaffiliated third party.

"Financial product or service" means any product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to such a financial activity under Section 4(k) of the Bank Holding Company Act of 1956. Financial service includes a financial institution's evaluation or brokerage of information that the financial institution collects in connection with a request or an application from a consumer for a financial product or service.

"Health care" means preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care, services, procedures, tests or counseling that relates to the physical, mental or behavioral condition of an individual or affects the structure or function of the human body or any part of the human body including the banking of blood, sperm, organs or any other tissues. "Health care" also means prescribing, dispensing or furnishing to an individual drugs or biologicals, or medical devices or health care equipment and supplies.

"Health care provider" means a physician or health care practitioner licensed, accredited or certified to perform specified health services consistent with state law, or a health care facility.

"Health information" means any information or data except age, gender or nonmedical identifying information, whether oral or recorded in any form or medium, created by or derived from a health care provider or the consumer that relates to the following:

1. The past, present or future physical, mental or behavioral health or condition of an individual;

2. The provision of health care to an individual; or

3. Payment for the provision of health care to an individual.

"Insurance product or service" means any product or service that is offered by a licensee pursuant to the insurance laws of Iowa. "Insurance service" includes a licensee's evaluation, brokerage or distribution of information that the licensee collects in connection with a request or an application from a consumer for an insurance product or service.

"Licensee" means all licensed carriers, producers and other persons licensed or required to be licensed, or authorized or required to be authorized, or registered or required to be registered pursuant to the insurance laws of the state or by the department of health and human services. "Licensee" shall also include an unauthorized insurer that accepts business placed through a licensed excess lines broker but only in regard to the excess lines placements pursuant to state rules.

"Nonaffiliated third party" means any person except a licensee's affiliate or a person employed jointly by a licensee and any company that is not a licensee's affiliate. "Nonaffiliated third party" includes any company that is an affiliate solely by virtue of the direct or indirect ownership or control of the company by the licensee or its affiliate in conducting merchant banking or investment banking activities of the type described in Section 4(k)(4)(H) of the federal Bank Holding Company Act or insurance company investment activities of the type described in Section 4(k)(4)(I) of the federal Bank Holding Company Act.

"Nonpublic personal health information" means health information that identifies an individual who is the subject of the information or with respect to which there is a reasonable basis to believe that the information could be used to identify an individual.

"Nonpublic personal information" or "nonpublic personal financial information" means personally identifiable financial information and any list, description or other groupings of consumers and publicly available information pertaining to them that is derived using any personally identifiable financial information that is not publicly available.

"Nonpublic personal financial information" does not include health information, publicly available information, except as included on a list as described above or any list or description pertaining to consumers that is derived without using any personally identifiable financial information that is not publicly available.

"Opt out" means a direction by the consumer that the licensee not disclose nonpublic personal financial information about the consumer to a nonaffiliated third party other than as permitted by rules 191-90.12 (505), 191-90.13 (505), and 191-90.14 (505).

"Personally identifiable financial information" means any information a consumer provides to a licensee to obtain an insurance product or service from the licensee, information about a consumer resulting from a transaction involving an insurance product or service between a licensee and a consumer, or information the licensee otherwise obtains about a consumer in connection with providing an insurance product or service to that consumer.

Examples of "personally identifiable financial information" include:

1. Information a consumer provides to a licensee on an application to obtain an insurance product or service;

2. Account balance information and payment history;

3. The fact that an individual is or has been one of the licensee's customers or has obtained an insurance product or service from the licensee;

4. Any information about the licensee's consumer if it is disclosed in a manner that indicates that the individual is or has been the licensee's consumer;

5. Any information that a consumer provides to a licensee or that the licensee or its agent otherwise obtains in connection with collecting on a loan or servicing a loan;

6. Any information the licensee collects through an Internet cookie (an information-collecting device from a web server); and

7. Information from a consumer report.

"Personally identifiable financial information" does not include health information, a list of names and addresses of customers of an entity that is not a financial institution and information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, and addresses.

"Publicly available information" means any information that a licensee has a reasonable basis to believe is lawfully made available to the general public from federal, state, or local government records; widely distributed media sources; or disclosures to the general public that are required to be made by federal, state or local law.

A licensee has a reasonable basis to believe that information is lawfully made available to the general public if the licensee has taken steps to determine that the information is the type that is available to the general public and whether an individual can direct that the information not be made available to the general public and, if so, that the licensee's consumer has not done so.

Examples of "publicly available information" include:

1. Publicly available information in government records, which includes information in government real estate records and security interest filings.

2. Publicly available information from widely distributed media, which includes information from a telephone book, a television or radio program, a newspaper or a website that is available to the general public on an unrestricted basis. A website is not restricted merely because an Internet service provider or a site operator requires a fee or a password, so long as access is available to the general public.

3. A licensee has a reasonable basis to believe that mortgage information is lawfully made available to the general public if the licensee has determined that the information is of the type included on the public record in the jurisdiction where the mortgage would be recorded.

"Reasonably understandable" means the licensee's notice is reasonably understandable if it:

1. Uses clear, concise sentences, paragraphs, and sections;

2. Uses short explanatory sentences or bullet lists whenever possible;

3. Uses definite, concrete, plain language and active voice whenever possible;

4. Avoids multiple negatives;

5. Avoids legal or highly technical business terminology whenever possible; and

6. Avoids explanations that are imprecise and readily subject to different interpretations.

"Service provider" means a person who maintains, processes or otherwise is permitted access to customer information through the person's provision of services directly to the licensee.

Iowa Admin. Code r. 191-90.2

Adopted by IAB March 20, 2024/Volume XLVI, Number 19, effective 4/24/2024